Notifications
Clear all
Topic starter
22/06/2026 1:41 pm
TL;DR: Zero Trust efforts still leave most organisations exposed because 87% experienced multiple identity-related breaches last year while many cannot see 56% of their machine identities, according to SPHERE. The security model fails when identity visibility, ownership, and remediation remain incomplete across human and non-human populations.
NHIMG editorial — based on content published by SPHERE: Identity Intelligence and Zero Trust
By the numbers:
- 87% of organizations experienced multiple identity-related breaches last year despite having Zero Trust initiatives in place.
- Most organizations cannot see 56% of their machine identities.
- Machine identities now outnumber human identities 82 to 1.
Questions worth separating out
Q: How should security teams improve Zero Trust when machine identities are mostly invisible?
A: They should start with continuous discovery, ownership validation, and entitlement mapping before trying to automate remediation.
Q: Why do unmanaged non-human identities undermine Zero Trust architectures?
A: Unmanaged non-human identities undermine Zero Trust because the model assumes every identity can be verified, classified, and constrained.
Q: What breaks when ownership is missing for service accounts and API keys?
A: Access review, remediation, and accountability all break when ownership is missing.
Practitioner guidance
- Establish continuous identity discovery across all identity stores Scan directories, cloud platforms, databases, infrastructure, and application-layer identity sources continuously so new service accounts and secrets do not sit unnoticed between review cycles.
- Map ownership for every non-human identity Require a validated owner for service accounts, API keys, tokens, and automation identities, then block remediation workflows from acting on unowned accounts without escalation.
- Correlate entitlement chains before approving access changes Trace inherited and nested permissions across PAM, IGA, cloud IAM, and directory services so privilege decisions are based on the full access path rather than a single account record.
What's in the full article
SPHERE Technology Solutions' full guide covers the operational detail this post intentionally leaves for the source:
- A full IVIP architecture view showing how discovery, analytics, ownership mapping, and remediation connect to existing PAM, IGA, SIEM, and ITSM tools.
- KPI definitions and target thresholds for identity hygiene score, mean time to remediation, and privileged account exposure reduction.
- Implementation guidance for universal discovery across cloud, directory, database, and infrastructure identity sources.
- Examples of how organisations use automated remediation without disrupting production workflows.
👉 Read SPHERE Technology Solutions' guide to identity intelligence and Zero Trust →
Identity intelligence and zero trust: why visibility still fails?
Explore further
This topic was modified 1 hour ago by Mr NHI
22/06/2026 1:46 pm
Identity intelligence is now the control layer that determines whether Zero Trust is real or rhetorical. Zero Trust was designed for environments where the organisation could verify identities before granting access, but that assumption fails when the identity estate is incomplete. If 56% of machine identities are invisible, access decisions are being made against partial truth. The implication is that Zero Trust maturity now depends on identity completeness, not just policy language.
A few things that frame the scale:
- Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them, according to Ultimate Guide to NHIs.
- 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface, according to Ultimate Guide to NHIs.
A question worth separating out:
Q: Who should be accountable for identity intelligence in a Zero Trust programme?
A: Accountability should sit across IAM, PAM, IGA, cloud operations, and security leadership, with clear ownership for discovery, classification, and remediation. The reason is simple: identity intelligence spans multiple control planes, so no single tool or team can govern it alone. Programmes work best when ownership, escalation, and reporting are explicitly assigned.
👉 Read our full editorial: Identity intelligence is the missing layer in zero trust
